diff --git a/docs/standalone.xml b/docs/standalone.xml index 34d6da9c5..c7bb78967 100644 --- a/docs/standalone.xml +++ b/docs/standalone.xml @@ -515,15 +515,16 @@ root@lists:~# If you wish to enable connections from the Internet to your firewall and you find an appropriate macro in - /etc/shorewall/macro.*, the general format of a rule - in /etc/shorewall/rules is: + /usr/share/shorewall/macro.*, the general format of a + rule in /etc/shorewall/rules is: #ACTION SOURCE DESTINATION PROTO DEST PORT(S) <macro>(ACCEPT) net $FW Be sure to add your rules after the line that reads SECTION NEW. + role="bold">SECTION NEW (?SECTION NEW in Shorewall 4.6.0 and + later). @@ -605,19 +606,34 @@ SSH(ACCEPT) net $FW shorewall stop. When the firewall is stopped, routing is enabled on those hosts that have an entry in /etc/shorewall/routestopped. - A running firewall may be restarted using the shorewall - restart command. If you want to totally remove any trace - of Shorewall from your Netfilter configuration, use - shorewall clear. + url="manpages/shorewall-stoppedrules.html">/etc/shorewall/stoppedrules + (/etc/shorewall/routestopped + in Shorewall 4.5.7 and earlier). A running firewall may be restarted using + the shorewall restart command. If you + want to totally remove any trace of Shorewall from your Netfilter + configuration, use shorewall + clear. If you are connected to your firewall from the Internet, do not issue a shorewall stop command unless - you have added an entry for the IP address that you are connected from - to /etc/shorewall/routestopped. - Also, I don't recommend using shorewall + you have either: + + + + Used ADMINISABSENTMINDED=Yes in + /etc/shorewall/shorewall.conf or + + + + added an entry for the IP address that you are connected from + to /etc/shorewall/routestopped. + + + + Also, I don't recommend using shorewall restart; it is better to create an alternate configuration and test it using the @@ -954,8 +953,8 @@ DNS(ACCEPT) $FW dmz:10.10.11.1 a defined macro. Shorewall includes a number of defined macros and you can add your own. To see the list of macros included with your version of Shorewall, run the - command ls - /usr/share/shorewall/macro.*. + command shorewall show + macros. You don't have to use defined macros when coding a rule in /etc/shorewall/rules. The first example above (name @@ -1128,12 +1127,14 @@ ACCEPT net $FW tcp 80 The firewall is started using the shorewall start command and stopped using shorewall stop. When the firewall is stopped, routing is enabled on those hosts that have an entry - in /etc/shorewall/routestopped. - A running firewall may be restarted using the shorewall - restart command. If you want to totally remove any trace of - Shorewall from your Netfilter configuration, use shorewall - clear. + in /etc/shorewall/stoppedrules + (/etc/shorewall/routestopped + on Shorewall 4.5.7 and earlier). A running firewall may be restarted using + the shorewall restart command. If you want to totally + remove any trace of Shorewall from your Netfilter configuration, use + shorewall clear. @@ -1144,16 +1145,26 @@ ACCEPT net $FW tcp 80 /etc/shorewall/routestopped accordingly. If you are connected to your firewall from the Internet, do not - issue a shorewall stop command unless you have - added an entry for the IP address that you are connected from to - /etc/shorewall/routestopped. - Also, I don't recommend using shorewall restart; it - is better to create an alternate - configuration and test it using the shorewall - try command. + issue a shorewall stop command + unless you have either: + + + + Used ADMINISABSENTMINDED=Yes in + /etc/shorewall/shorewall.conf; or + + + + added an entry for the IP address that + you are connected from to /etc/shorewall/routestopped. + + + + Also, I don't recommend using shorewall + restart; it is better to create an alternate + configuration and test it using the shorewall + try command. The firewall will start after your network interfaces have been diff --git a/docs/two-interface.xml b/docs/two-interface.xml index 870b05b91..5026414a6 100644 --- a/docs/two-interface.xml +++ b/docs/two-interface.xml @@ -171,7 +171,6 @@ /usr/share/doc/packages/shorewall/Samples/two-interfaces/interfaces /usr/share/doc/packages/shorewall/Samples/two-interfaces/masq /usr/share/doc/packages/shorewall/Samples/two-interfaces/policy -/usr/share/doc/packages/shorewall/Samples/two-interfaces/routestopped /usr/share/doc/packages/shorewall/Samples/two-interfaces/rules /usr/share/doc/packages/shorewall/Samples/two-interfaces/zones ~# @@ -203,8 +202,9 @@ If you install using the .deb, you will find that your /etc/shorewall directory - is empty. This is intentional. The released configuration file - skeletons may be found on your system in the directory /usr/share/doc/shorewall/default-config. Simply copy the files you need from that directory to /etc/shorewall and modify the @@ -910,8 +910,8 @@ DNS(ACCEPT) $FW netThis rule allows In the rule shown above, DNS(ACCEPT)is an example of a macro invocation. Shorewall includes a number of - macros (see /usr/share/shorewall/macro.*) and you can add your own. + macros (command shorewall show macros) + and you can add your own. You don't have to use defined macros when coding a rule in /etc/shorewall/rules; Shorewall will start slightly @@ -1046,7 +1046,9 @@ ACCEPT loc $FW tcp 80 #Allow Weblet to workshorewall stop. When the firewall is stopped, routing is enabled on those hosts that have an entry in /etc/shorewall/routestopped. + url="manpages/shorewall-routestopped.html">routestopped + (Shorewall 4.5.7 and earlier) or in /etc/shorewall/stoppedrules. A running firewall may be restarted using the shorewall restart command. If you want to totally remove any trace of Shorewall from your Netfilter configuration, use @@ -1063,10 +1065,22 @@ ACCEPT loc $FW tcp 80 #Allow Weblet to work If you are connected to your firewall from the Internet, do not issue a shorewall stop command - unless you have added an entry for the IP address - that you are connected from to /etc/shorewall/routestopped. - Also, I don't recommend using shorewall + unless you have either: + + + + Used ADMINISABSENTMINDED=Yes in + /etc/shorewall/shorewall.conf; or + + + + added an entry for the IP address that + you are connected from to /etc/shorewall/routestopped. + + + + Also, I don't recommend using shorewall restart; it is better to create an alternate configuration and test it using the shorewall try command.